When using release stations or account selection popups, PaperCut pauses jobs on the Windows print queue to hold jobs prior to printing. It is important, especially in charging environments, that the queue is secured to prevent users from resuming jobs themselves and bypassing PaperCut.
There are two ways a Windows print queue can be secured:
- Restrict the print queue security permissions to prevent users from performing management functions.
- Configure the queue using the PaperCut TCP/IP Port.
Restricting Windows Print Queue Security Permissions
In order to use this method with Windows Server 2012 and 2012R2, Microsoft released a patch for Windows Server 2012 and 2012R2. As always, please consult your Microsoft experts as to the suitability of this patch.
To change print queue permissions:
- Log onto the server hosting the printers as an Administrator.
- Open the printer configuration screen:
Start → Printers
- Right-click a printer and select
- Select the Security tab.
- Select the
CREATOR OWNER user and un-check the
Manage Documents permission.
- Press the OK button.
- Perform these steps for each of the monitored printers.
This task is Step 2 in the installation manual, however is often forgotten: https://www.papercut.com/products/ng/manual/ch-installation.html#ch-installation-win-print-queue-conf
A tip from one of our customers (Chris), is to use Server Manager, navigate to the Print Management Console and globally set the security permissions by right-clicking the
Print Server(s) →
Security and editing the permissions there.
Using the PaperCut TCP/IP Port
PaperCut TCP/IP port is mainly used for enabling hardware checking.
Queues configured to use the PaperCut TCP/IP Port (in PaperCut version 14.1 or higher) will automatically ensure that manually resumed jobs will not be printed. You will already be using a PaperCut TCP/IP Port if you are using hardware page count validation. You can see which port is being used in the
Ports tab under
Note: If you’re using Virtual queues on your server which are redirecting to other target queues, the recommendation is to use LPT or ‘nul’ ports for the Virtual queues - since no jobs should be actually printing from that queue. In that case, since the virtual queues can’t print, you won’t need to use the PaperCut TCP/IP ports on the target queues, unless you’re using them for hardware checking.
If you are not currently using PaperCut TCP/IP ports, you may do so by following the hardware checking setup instructions.
Sent to printer - Jobs stuck in queue
In some rare circumstances it’s been observed that when changing permissions on print queues AND changing driver isolation modes, print jobs may remain in the print queue with the status of “Sent to printer”. Microsoft released a patch for Windows 7 and Windows Server 2008R2. This may be relevant to your environment if you have this issue. As always, please consult your Microsoft experts as to the suitability of this patch.
In early 2014, PaperCut Technical Support also found that the HP Universal Driver had similar behaviour and required the “Enable bidirectional support” on the Ports tab to be unticked.
Access Denied errors
If you receive an “
Access denied” error when changing both the
CREATOR OWNER permissions and the
Print Driver Isolation settings you may need to turn off the
Render print jobs on client computers found under the Sharing Tab for that printer.
Categories: Administration, Security
Keywords: hold / release, rights, initial set up, step, miss, missed, queue resume print, right-click resume, job